diff options
| author | Egbert Eich <eich@suse.com> | 2022-12-02 05:04:42 (GMT) |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-12-02 05:04:42 (GMT) |
| commit | 4e0277c35a5a6e8eb84058a905efa06bb3915985 (patch) | |
| tree | 08e110d8f92bdd3ecdb41ed42c075667e2b27145 /src | |
| parent | 96a4e101023d0926f714e2dbec2e4ffca45abc16 (diff) | |
| download | hdf5-4e0277c35a5a6e8eb84058a905efa06bb3915985.zip hdf5-4e0277c35a5a6e8eb84058a905efa06bb3915985.tar.gz hdf5-4e0277c35a5a6e8eb84058a905efa06bb3915985.tar.bz2 | |
Report error if dimensions of chunked storage in data layout < 2 (#2241)
For Data Layout Messages version 1 & 2 the specification state
that the value stored in the data field is 1 greater than the
number of dimensions in the dataspace. For version 3 this is
not explicitly stated but the implementation suggests it to be
the case.
Thus the set value needs to be at least 2. For dimensionality
< 2 an out-of-bounds access occurs as in CVE-2021-45833.
This fixes CVE-2021-45833 / Bug #2240.
Signed-off-by: Egbert Eich <eich@suse.com>
Signed-off-by: Egbert Eich <eich@suse.com>
Co-authored-by: Larry Knox <lrknox@hdfgroup.org>
Diffstat (limited to 'src')
| -rw-r--r-- | src/H5Olayout.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/src/H5Olayout.c b/src/H5Olayout.c index f7bbb5b..595c73e 100644 --- a/src/H5Olayout.c +++ b/src/H5Olayout.c @@ -167,6 +167,8 @@ H5O__layout_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNU p += ndims * 4; /* Skip over dimension sizes (32-bit quantities) */ } /* end if */ else { + if (ndims < 2) + HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "bad dimensions for chunked storage") mesg->u.chunk.ndims = ndims; for (u = 0; u < ndims; u++) UINT32DECODE(p, mesg->u.chunk.dim[u]); @@ -240,6 +242,8 @@ H5O__layout_decode(H5F_t *f, H5O_t H5_ATTR_UNUSED *open_oh, unsigned H5_ATTR_UNU mesg->u.chunk.ndims = *p++; if (mesg->u.chunk.ndims > H5O_LAYOUT_NDIMS) HGOTO_ERROR(H5E_OHDR, H5E_CANTLOAD, NULL, "dimensionality is too large") + if (mesg->u.chunk.ndims < 2) + HGOTO_ERROR(H5E_OHDR, H5E_OVERFLOW, NULL, "bad dimensions for chunked storage") /* B-tree address */ H5F_addr_decode(f, &p, &(mesg->storage.u.chunk.idx_addr)); |